remove all mentions and files about gitea from smallwebwaf:next immediately. there is nothing in there that should be specific to a gitea deployment.
Definition of done, on one PR into next:
Deleted: deploy/gitea/, docs/gitea.md, script/gitea-setup, script/gitea-requests, and the gitea-setup and gitea-requests targets in the Makefile with their comment lines and .PHONY entries.
Nothing Gitea-specific is left in the code:
in internal/waf/waf.go, the exclusions written for Gitea, such as the gitea_flash cookie and the query parameters Gitea sends names in, are removed;
in internal/config/config.go, the example name in the error message is a neutral one.
Nothing Gitea-specific is left in the documents: README.md, SPEC.md, docs/settings.md, docs/rules.md and EVALUATION.md. A sentence that used Gitea as its example uses a generic web app instead, or goes. The rules-file example in docs/rules.md gets a neutral name.
Tests that use Gitea as an example name or host use a neutral one, and nothing else in them changes.
Kept, because they are not about a deployment: .gitea/workflows/check.yml (this repo's own CI) and REPO_POLICIES.md (the shared policy text).
git grep -i gitea finds nothing outside those two files.
make check passes.
Model: opus-5-5
sneak, in chat on 7 November:
> remove all mentions and files about gitea from smallwebwaf:next immediately. there is nothing in there that should be specific to a gitea deployment.
**Definition of done**, on one PR into `next`:
- Deleted: `deploy/gitea/`, `docs/gitea.md`, `script/gitea-setup`, `script/gitea-requests`, and the `gitea-setup` and `gitea-requests` targets in the `Makefile` with their comment lines and `.PHONY` entries.
- Nothing Gitea-specific is left in the code:
- in `internal/waf/waf.go`, the exclusions written for Gitea, such as the `gitea_flash` cookie and the query parameters Gitea sends names in, are removed;
- in `internal/config/config.go`, the example name in the error message is a neutral one.
- Nothing Gitea-specific is left in the documents: `README.md`, `SPEC.md`, `docs/settings.md`, `docs/rules.md` and `EVALUATION.md`. A sentence that used Gitea as its example uses a generic web app instead, or goes. The rules-file example in `docs/rules.md` gets a neutral name.
- Tests that use Gitea as an example name or host use a neutral one, and nothing else in them changes.
- Kept, because they are not about a deployment: `.gitea/workflows/check.yml` (this repo's own CI) and `REPO_POLICIES.md` (the shared policy text).
- `git grep -i gitea` finds nothing outside those two files.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-11-07 02:52:29 +01:00
Built in #210. The Gitea files, scripts and make targets are deleted. The Core Rule Set no longer skips the ten Gitea query parameters or the gitea_flash and redirect_to cookies, which leaves five changes instead of six. Documents and tests use neutral names. The README's "In front of gitea" compose example is gone and has no replacement.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/210. The Gitea files, scripts and make targets are deleted. The Core Rule Set no longer skips the ten Gitea query parameters or the `gitea_flash` and `redirect_to` cookies, which leaves five changes instead of six. Documents and tests use neutral names. The README's "In front of gitea" compose example is gone and has no replacement.
Model: opus-5-5
Amendment for the worker, by sneak in chat on 7 November, on the exclusions in internal/waf/waf.go:
no, that's still a legitimate false positive because gitea is a common selfhosted app
Keep the web-attack-rule exclusions in internal/waf/waf.go that stop ordinary Gitea traffic being refused, such as the gitea_flash cookie and the query parameters Gitea sends names in. Keep the comments there that name Gitea, and their tests. Gitea is a common self-hosted app, so its false positives belong in smallwebwaf's defaults.
Everything else in the definition of done stands. Only files and mentions about deploying smallwebwaf in front of Gitea go: the setup folder, its scripts and Makefile targets, docs/gitea.md, and Gitea as the example deployment in the documents and tests.
git grep -i gitea may then also find internal/waf/ and its tests.
Model: opus-5-5
**Amendment for the worker**, by sneak in chat on 7 November, on the exclusions in `internal/waf/waf.go`:
> no, that's still a legitimate false positive because gitea is a common selfhosted app
- **Keep** the web-attack-rule exclusions in `internal/waf/waf.go` that stop ordinary Gitea traffic being refused, such as the `gitea_flash` cookie and the query parameters Gitea sends names in. Keep the comments there that name Gitea, and their tests. Gitea is a common self-hosted app, so its false positives belong in smallwebwaf's defaults.
- **Everything else in the definition of done stands.** Only files and mentions about deploying smallwebwaf in front of Gitea go: the setup folder, its scripts and `Makefile` targets, `docs/gitea.md`, and Gitea as the example deployment in the documents and tests.
- `git grep -i gitea` may then also find `internal/waf/` and its tests.
Model: opus-5-5
Amendment applied in #210. The Gitea false-positive exclusions in internal/waf/waf.go, their comments, their tests and their SPEC.md text are back as they were on next. Only what is about deploying behind Gitea is removed.
Model: opus-5-5
Amendment applied in https://git.eeqj.de/sneak/smallwebwaf/pulls/210. The Gitea false-positive exclusions in `internal/waf/waf.go`, their comments, their tests and their `SPEC.md` text are back as they were on `next`. Only what is about deploying behind Gitea is removed.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak, in chat on 7 November:
Definition of done, on one PR into
next:deploy/gitea/,docs/gitea.md,script/gitea-setup,script/gitea-requests, and thegitea-setupandgitea-requeststargets in theMakefilewith their comment lines and.PHONYentries.internal/waf/waf.go, the exclusions written for Gitea, such as thegitea_flashcookie and the query parameters Gitea sends names in, are removed;internal/config/config.go, the example name in the error message is a neutral one.README.md,SPEC.md,docs/settings.md,docs/rules.mdandEVALUATION.md. A sentence that used Gitea as its example uses a generic web app instead, or goes. The rules-file example indocs/rules.mdgets a neutral name..gitea/workflows/check.yml(this repo's own CI) andREPO_POLICIES.md(the shared policy text).git grep -i giteafinds nothing outside those two files.make checkpasses.Model: opus-5-5
Built in #210. The Gitea files, scripts and make targets are deleted. The Core Rule Set no longer skips the ten Gitea query parameters or the
gitea_flashandredirect_tocookies, which leaves five changes instead of six. Documents and tests use neutral names. The README's "In front of gitea" compose example is gone and has no replacement.Model: opus-5-5
Amendment for the worker, by sneak in chat on 7 November, on the exclusions in
internal/waf/waf.go:internal/waf/waf.gothat stop ordinary Gitea traffic being refused, such as thegitea_flashcookie and the query parameters Gitea sends names in. Keep the comments there that name Gitea, and their tests. Gitea is a common self-hosted app, so its false positives belong in smallwebwaf's defaults.Makefiletargets,docs/gitea.md, and Gitea as the example deployment in the documents and tests.git grep -i giteamay then also findinternal/waf/and its tests.Model: opus-5-5
Amendment applied in #210. The Gitea false-positive exclusions in
internal/waf/waf.go, their comments, their tests and theirSPEC.mdtext are back as they were onnext. Only what is about deploying behind Gitea is removed.Model: opus-5-5